diff --git a/PayPalEE.cert b/PayPalEE.cert
new file mode 100644
index 0000000..6e7f755
Binary files /dev/null and b/PayPalEE.cert differ
diff --git a/PayPalICA.cert b/PayPalICA.cert
new file mode 100644
index 0000000..459373b
Binary files /dev/null and b/PayPalICA.cert differ
diff --git a/nss.spec b/nss.spec
index ef5635c..1df2f42 100644
--- a/nss.spec
+++ b/nss.spec
@@ -4,7 +4,7 @@
 Summary:          Network Security Services
 Name:             nss
 Version:          3.12.3.99.3
-Release:          1%{?dist}
+Release:          2%{?dist}
 License:          MPLv1.1 or GPLv2+ or LGPLv2+
 URL:              http://www.mozilla.org/projects/security/pki/nss/
 Group:            System Environment/Libraries
@@ -29,6 +29,8 @@ Source4:          blank-key3.db
 Source5:          blank-secmod.db
 Source8:          nss-prelink.conf
 Source12:         %{name}-pem-20080124.tar.bz2
+Source13:         PayPalEE.cert
+Source14:         PayPalICA.cert
 
 Patch1:           nss-no-rpath.patch
 Patch2:           nss-nolocalsql.patch
@@ -107,6 +109,10 @@ low level services.
 %patch5 -p0 -b .429175
 %patch6 -p0 -b .libpem
 
+#need newer certs to make test suite work
+#remove once we update to NSS 3.12.4
+cp %{SOURCE13} %{SOURCE14} mozilla/security/nss/tests/libpkix/certs
+
 
 %build
 
@@ -213,21 +219,20 @@ find ./mozilla/security/nss/tests -type f |\
 
 killall $RANDSERV || :
 
-#temporarily disable the test suite because of bug 494266
-#rm -rf ./mozilla/tests_results
-#cd ./mozilla/security/nss/tests/
-## all.sh is the test suite script
-#HOST=localhost DOMSUF=localdomain PORT=$MYRAND ./all.sh
-#cd ../../../../
+rm -rf ./mozilla/tests_results
+cd ./mozilla/security/nss/tests/
+# all.sh is the test suite script
+HOST=localhost DOMSUF=localdomain PORT=$MYRAND ./all.sh
+cd ../../../../
 
-#killall $RANDSERV || :
+killall $RANDSERV || :
 
-#TEST_FAILURES=`grep -c FAILED ./mozilla/tests_results/security/localhost.1/output.log` || :
-#if [ $TEST_FAILURES -ne 0 ]; then
-#  echo "error: test suite returned failure(s)"
-#  exit 1
-#fi
-#echo "test suite completed"
+TEST_FAILURES=`grep -c FAILED ./mozilla/tests_results/security/localhost.1/output.log` || :
+if [ $TEST_FAILURES -ne 0 ]; then
+  echo "error: test suite returned failure(s)"
+  exit 1
+fi
+echo "test suite completed"
 
 # Produce .chk files for the final stripped binaries
 %define __spec_install_post \
@@ -473,6 +478,8 @@ done
 
 
 %changelog
+* Fri Jun 05 2009 Kai Engert <kaie@redhat.com> - 3.12.3.99.3-2
+- reenable test suite
 * Fri Jun 05 2009 Kai Engert <kaie@redhat.com> - 3.12.3.99.3-1
 - updated to NSS_3_12_4_FIPS1_WITH_CKBI_1_75
 * Fri May 08 2009 Kai Engert <kaie@redhat.com> - 3.12.3-4